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REMARKS 

The Examiner has rejected Claims 1-37 under 35 U.S.C. 103(a) as being 
unpatentable over CNN f hltDi/Avvvw- 

cei.cnn.comArECH/coninutinLz/9907/21/badiapjdaA ). Applicant respectfully disagrees 
with such rejection for the reasons stated below. 

To estabhsh a prima facie case of obviousness, tluee basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modil^' the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir,1991). Applicant respectfully asserts that at least the third element of the 
prima facie case of obviousness has not been met. 

Specifically, regarding independent Claim 1 et al., the Examiner states that 
encrypting information is well known in the art for the motivation of hiding information 
from a hacker who appears to be using a malicious code to seize control of a system, and 
acknowledges that CNN does not teach encrypting information, as claimed by applicant. 
Applicant respectfully disagrees with this assertion. 

In invoking such Official Notice, the Examiner has failed to recognize the full 
weight of applicant's claims. Specifically, appHcant teaches and claims encrypting 
information relating to malicious code , and not simply encrypting any information in 
order to hide it from a hacker. Applicant thus formally requests a specific showing of the 
subject matter in ALL of the claims in any future action. Note excerpt from MPEP 
belov^'. 

i 

I 
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'^If the applicant traverses such an [Official 
Notice] assertion the examiner should cite a 
reference in support of his or her position." See 
MPEP 21^4,03. 

Further, the Examiner has relied on the following excerpt from CNN to make a 
prior art showing of applicant's claimed "sending the encrypted information relating to 
the mahcious code to a plurality of remote locations utilizing the network; and blocking 
instances of the malicious code at the remote locations for a predetermined amount of 
time based on the information": 

"It's just another Trojan horse for us," says 
Darren Kessner, Symantec's senior virus 
researcher. "Most Trojans are delivered as 
attachments in e-mail, and with our Norton Anti- 
Virus product, you now have an option to destroy 
or quarantine them in order to send them to our 
researcher , " 

Again, applicant respectfully disagrees with this assertion. CNN simply states that 
when a Trojan is found at a local location, a user has the option to either destroy that 
Trojan at the local location or quarantine the Trojan in order to send it to a researcher. 
Thus, CNN does not even suggest sending encrypted information relating to the 
malicious code to a plurality of remote locations , nor does it suggest blocking instances 
of the malicious code at those remote locations for a predetermined amount of time based 
on the information . CNN thus fails to give any indication that encrypted information 
relating to identified malicious code is sent to multiple remote locations such that those 
locations can block instances of the malicious code for predetennined amounts of time. 

Applicant respectfully asserts that at least the third element of the prima faci(^ 
case of obviousness has not been met, since the prior art reference fails to teach or 
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susigest all the claim limitations. To this end, all of the pending independent claims are 
deemed allowable, along with any dependent claims dependent therefrom. A notice of 
allowance or a specific prior art showing of each of the foregoing limitations, in 
combination with the remaining claim elements, is respectfully requested. 

CNN is further deficient with respect to applicant's dependent claims. For 
example, the Examiner also rehes on the above exceipt to make a prior art showing of 
applicant's claimed, "wherein the information relating to the malicious code includes an 
identification of the source of the malicious code, wherein communications originating at 
the identified source are denied access to the remote locations for the predetermined 
amount of time" (see same or similar claim language in Claims 3, 12-13 and 21, for 
example). Applicant respectfully disagrees with this assertion. 

Specifically, applicant claims denying access to remote locations by the malicious 
code to remote locations based on the identified source for a predetermined amount of 
time. This is vastly different from CNN's suggestion of simply destroying a Trojan at the 
local location it was discovered, or quarantining such Trojan. Clearly, the malicious code 
described in CNN is not being denied access based on an identified source for a 
predetermined amount of time. 

With respect to dependent Claims 4-8, 14-16, 20, 22-25 and 29-34, the Examiner 
has simply dismissed the saine under Official Notice. In response, applicant again points 
out the remarks above. Applicant thus formally requests a specific showing of the 
subject matter in ALL of the claims in any future action. Again, note the excerpt from 
MPEP below; 

"If the applicant traverses such an [Official 
Notice] assertion the examiner should cite a 
reference in support of his or her position. See 
MPEP 214^ . 03 . 
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Again, applicant respectfully asserts that at least the third element of the prima 
facie case of obviousness has not been met, since the prior art reference fails to teach or 
suggest all the claim limitations . A notice of allowance or a specific prior art showing of 
each of the foregoing limitations, in combination with the remaining claim elements, is 
respectfully requested. 

Still yet, applicant brings the Examiner's attention to the following subject matter 
in the added dependent claims, for full consideration: 

^'wherein the information includes a type, context, protocol, severity, reporting 
server, and IP address associated with the malicious code" (see Claim 38); 

"wherein the type is selected from the group consisting of an unwanted message 
attempt, and a denial of ser\'ice attack" (see Claim 39); 

"wherein the context is selected from the group consisting of a virus name, a 
subject, a mail header, and a magic number for a message" (see Claim 40); 

''attempting to identify a source of the malicious code, and, if the source is 
identified, retrieving information about the source from a database" (see Claim 
41); and 

"wherein additional information relating to the malicious code is retrieved from a 
database if the malicious code is not identified in conjunction with an event at the 
local location on the network" (see Claim 42). 

Again, a notice of allowance or a specific prior art showing of each of the 
foregoing limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Reconsideration is respectfully requested. 
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In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. Applicants are 
enclosing a check to pay for the added claims. The Commissioner is authorized to charge 
any additional fees or credit any overpayment to Deposit Account No. 50-1351 (Order 
No. NAnP025). 



P.O. Box 721120 

San Jose, CA 95172-1120 

408-505-5100 
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